delete the gate that could not run; start the one that can

We do not use GitHub Actions. `.github/workflows/cicd.yml` asked for
`hanzo-build-linux-amd64`, a label github.com serves with nothing, so every
caller queued 86402s — 24h exactly, GitHub's timeout — and reported
"cancelled". Not a broken gate: a gate on a platform we retired. Deleted rather
than repaired. A file that asserts coverage it cannot deliver is what let this
repo read green while nothing ran.

The forge is where CI lives, and this repo was not wired to it. Two things were
missing and the second is the interesting one.

`.hanzo/workflows/cicd.yml` — the ~7-line caller, hanzo.yml holds the config,
same shape as the sixteen other hanzoai repos already on this path.

And sync-from-github.yml could never have started it. It fast-forwards main
with the workflow token, which by design triggers no workflow, and compensates
by dispatching `deploy.yml` — a workflow this repo has never had, because these
are libraries that publish to PyPI and deploy nothing. The forge returned 404,
`|| echo "build dispatch failed (non-fatal)"` swallowed it, and the sync went
green ten minutes at a time. Every commit arrived having started nothing. That
is the third check this session that was believed and was not running, and it
is why the forge shows zero cicd.yml runs against 775 syncs.

It now names cicd.yml, and a failed dispatch fails the job.

hanzo.yml gains `duplicate-fields`: repeated AnnAssign targets in a class body,
read from the AST. 3.2.0 shipped `integration_config` and `removed_at` declared
twice each in O11yGettableAgentCheckIn — the second binding wins, the first
field silently does not exist, and the value on the wire was read and dropped.
The `cloud-client` import gate was green for it and always would be: measured
here, with the 3.2.0 model restored, it exits 0 and prints "models: 2172
modules imported". Its comment claimed it caught name collisions; that claim is
corrected rather than left to mislead.

Co-authored-by: Hanzo Dev <[email protected]>

.github/workflows/cicd.yml

@@ -1,12 +0,0 @@
-name: CI/CD
-on:
-  push: { branches: [main], tags: ["v*"] }
-  pull_request:
-  # ONE cloud release, every projection. hanzoai/ci's client: lane
-  # (hanzo.yml) is what this fires.
-  repository_dispatch: { types: [spec-update] }
-  workflow_dispatch:
-jobs:
-  cicd:
-    uses: hanzoai/ci/.github/workflows/build.yml@v1
-    secrets: inherit

.hanzo/workflows/sync-from-github.yml

@@ -48,11 +48,22 @@ jobs:
             # A push made with the workflow token does NOT trigger other workflows
             # (loop prevention), so synced commits would never build. Dispatch it
             # explicitly — a real fast-forward means real commits arrived.
+            #
+            # It dispatched `deploy.yml`, which this repo does not have and never
+            # had: these are libraries, they publish to PyPI and deploy nothing.
+            # The forge answered 404 every time, `|| echo ... (non-fatal)` ate it,
+            # and the job went green. So every commit synced from GitHub landed
+            # here having triggered NOTHING, and the gate this repo declares in
+            # hanzo.yml has no runs at all to show for it.
+            #
+            # Name the workflow that exists, and let a failed dispatch fail the
+            # job. A sync that lands commits but cannot start the gate is the
+            # exact false green this whole exercise is about.
             curl -fsS --max-time 20 -X POST \
               -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
               -H "Content-Type: application/json" \
-              "${{ github.server_url }}/v1/repos/${{ github.repository }}/actions/workflows/deploy.yml/dispatches" \
-              -d '{"ref":"main"}' || echo "build dispatch failed (non-fatal)"
+              "${{ github.server_url }}/v1/repos/${{ github.repository }}/actions/workflows/cicd.yml/dispatches" \
+              -d '{"ref":"main"}'
           else
             echo "DIVERGED: native $LOCAL is not an ancestor of GitHub $REMOTE." >&2
             echo "Resolve by hand; this job will not force-push either side." >&2